The application does not properly handle concurrent requests, allowing attackers to exploit time-of-check to time-of-use (TOCTOU) gaps to bypass validation or duplicate actions.
An attacker could duplicate financial transactions, bypass rate limits, exploit voucher codes multiple times, create duplicate accounts, or manipulate resource allocation.
Implement proper locking mechanisms for critical sections. Use database transactions with appropriate isolation levels. Apply optimistic or pessimistic locking patterns. Use idempotency keys for financial operations.